JWT Auditor

About

JWTAuditorMCP is a powerful MCP server designed to provide a comprehensive suite of tools for auditing JSON Web Tokens. Inspired by JWTAuditor, it offers robust capabilities to decode JWT components, identify various security vulnerabilities (such as weak algorithms or sensitive data exposure), and even brute-force secrets. Additionally, it enables users to generate and modify JWTs, supporting both HS* and RS* algorithms. All operations are performed locally, ensuring sensitive data remains private, making it an invaluable resource for security researchers and developers working with JWTs.

Key Features

• Brute-force HS256/HS384/HS512 JWT secrets using a wordlist
• Generate and edit JWTs supporting HS* and RS* algorithms
• Decode JWT header, payload, and signature
• Analyze JWTs for vulnerabilities (e.g., alg=none, weak algorithms, missing claims)
• 0 GitHub stars

Use Cases

• Analyzing potential security vulnerabilities in JWTs during penetration testing
• Brute-forcing JWT secrets to assess the strength of cryptographic keys
• Creating and manipulating JWTs for development, testing, or security research purposes